I have the following search
index=firewall policy_name="/Common/default" request_status=blocked (violations="Access from malicious IP address" OR violations="Web scraping detected") | chart count over date_mday by violations
which gives the following chart
date_mday Access from malicious IP address Web scraping detected
14 18951 65
15 16891 176
but what I want is
date_mday Access from malicious IP address Web scraping detected Total
14 18951 65 19016
15 16891 176 17067
↧